Communication links between two computers on a network, such as the Internet or a local-area network, are subject to various types of degradation and failure conditions. Protocol analysis is frequently used to determine where potential problems exist in a network. Messages flowing through a communication channel between two computers are encoded into “protocol data units” according to a multi-layered data communication protocol, such as defined in the OSI (Open Systems Interconnection) model. By capturing the protocol data units, the data at each protocol layer can be extracted and reassembled to form the messages.
Proper analysis of the messages for certain protocols depends on matching corresponding request and reply messages. Generally, this is easily accomplished because corresponding protocol data units contain identical address pairs, with the source and destination addresses reversed between the protocol data units for the request and the reply. However, many computers now contain more than one network interface card. If such a computer receives a request on one network interface, it may send the reply on a different network interface, resulting in two different address pairs for the request and reply protocol data units at the data link protocol layer. Additionally, the addresses for the request and reply may not match because of routers and/or switches in the network.